linux-kernel - RE:[PATCH] scsi: fix out of bounds error in /drivers/scsi

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [day] [month] [year] [list]

Message-ID: <tencent_D9A0F9052526AD09F7FF76DD5F2529FDDD05@qq.com>
Date: Wed, 18 Jun 2025 14:31:55 +0800
From: jackysliu <1972843537@...com>
To: bvanassche@....org
Cc: 1972843537@...com,
	James.Bottomley@...senPartnership.com,
	linux-kernel@...r.kernel.org,
	linux-scsi@...r.kernel.org,
	martin.petersen@...cle.com
Subject: RE:[PATCH] scsi: fix out of bounds error in /drivers/scsi

On 6/17/25 2:03 AM, jackysliu wrote:
> Out-of-bounds vulnerability found in ./drivers/scsi/sd.c,
> sd_read_block_limits_ext Function Due to Unreasonable boundary checks.
> Out-of-bounds read vulnerability exists in the
> Linux kernel's SCSI disk driver (./drivers/scsi/sd.c).
> The flaw occurs in the sd_read_block_limits_ext function
>   when processing Vital Product Data (VPD) page B7 (Block Limits Extension)
>   responses from storage devices
> 
> Signed-off-by: jackysliu <1972843537@...com>
> ---
>   drivers/scsi/sd.c | 2 +-
>   1 file changed, 1 insertion(+), 1 deletion(-)
> 
> diff --git a/drivers/scsi/sd.c b/drivers/scsi/sd.c
> index 3f6e87705b62..eeaa6af294b8 100644
> --- a/drivers/scsi/sd.c
> +++ b/drivers/scsi/sd.c
> @@ -3384,7 +3384,7 @@ static void sd_read_block_limits_ext(struct scsi_disk *sdkp)
>   
>   	rcu_read_lock();
>   	vpd = rcu_dereference(sdkp->device->vpd_pgb7);
> -	if (vpd && vpd->len >= 2)
> +	if (vpd && vpd->len >= 6)
>   		sdkp->rscs = vpd->data[5] & 1;
>   	rcu_read_unlock();
>   }

On 6/17/25 13:44 PM , Bart Van Assche wrote:
>Fixes: and Cc: stable tags are missing. Please add these.
>
>How has this been detected? Please mention this in the patch
>description. When I wrote the above code I was assuming that vpd->len
>represents the contents of the PAGE LENGTH field (bytes 2 and 3).
>Apparently vpd->len is the length in bytes of the entire VPD page.
>
>Thanks,
>
>Bart.

Sure,I'll explain in the patch later.
Can I know what kind of impact this vulnerability will have?
And is it possible to get a cve number?

Thanks,

Jackysliu